MDEV-6865 Merge Bug#18935421 RPAD DIES WITH CERTAIN PADSTR INTPUTS..

mysql-test/r/ctype_utf16.result

@@ -1198,5 +1198,14 @@ a	512
 Warnings:
 Warning	1260	Row 1 was cut by GROUP_CONCAT()
 #
+# MDEV-6865 Merge Bug#18935421 RPAD DIES WITH CERTAIN PADSTR INTPUTS..
+#
+DO RPAD(_utf16 0x0061 COLLATE utf16_unicode_ci, 10000, 0x0061DE989999);
+Warnings:
+Warning	1300	Invalid utf16 character string: 'DE9899'
+DO LPAD(_utf16 0x0061 COLLATE utf16_unicode_ci, 10000, 0x0061DE989999);
+Warnings:
+Warning	1300	Invalid utf16 character string: 'DE9899'
+#
 # End of 5.5 tests
 #

mysql-test/t/ctype_utf16.test

@@ -786,6 +786,12 @@ SELECT 'a' AS id, REPEAT('bla bla', 100) AS body) t1;
 ## TODO: add tests for all engines
 #
 
+--echo #
+--echo # MDEV-6865 Merge Bug#18935421 RPAD DIES WITH CERTAIN PADSTR INTPUTS..
+--echo #
+DO RPAD(_utf16 0x0061 COLLATE utf16_unicode_ci, 10000, 0x0061DE989999);
+DO LPAD(_utf16 0x0061 COLLATE utf16_unicode_ci, 10000, 0x0061DE989999);
+
 --echo #
 --echo # End of 5.5 tests
 --echo #

sql/item_strfunc.cc

@@ -2721,6 +2721,19 @@ String *Item_func_rpad::val_str(String *str)
     res->set_charset(&my_charset_bin);
     rpad->set_charset(&my_charset_bin);
   }
+#if MARIADB_VERSION_ID < 1000000
+  /*
+    Well-formedness is handled on a higher level in 10.0,
+    no needs to check it here again.
+  */
+  else
+  {
+    // This will chop off any trailing illegal characters from rpad.
+    String *well_formed_pad= args[2]->check_well_formed_result(rpad, false);
+    if (!well_formed_pad)
+      goto err;
+  }
+#endif
 
   if (count <= (res_char_length= res->numchars()))
   {						// String to pad is big enough
@@ -2826,6 +2839,18 @@ String *Item_func_lpad::val_str(String *str)
     res->set_charset(&my_charset_bin);
     pad->set_charset(&my_charset_bin);
   }
+#if MARIADB_VERSION_ID < 1000000
+  /*
+    Well-formedness is handled on a higher level in 10.0,
+    no needs to check it here again.
+  */  else
+  {
+    // This will chop off any trailing illegal characters from pad.
+    String *well_formed_pad= args[2]->check_well_formed_result(pad, false);
+    if (!well_formed_pad)
+      goto err;
+  }
+#endif
 
   res_char_length= res->numchars();